News for hackers. Stuff that matters.

A comment on Security assessment techniques for Go projects. Parent comment

Re:Security assessment techniques for Go projects by codegeek on Friday November 08, 2019 @11:12AM (#21483571)
"SQL Injection (Go's database integration is still the wild west)"

Is something like this prone to SQL injection ? I am very new to Go and still learning how to interact with databases (I am not a big fan of ORMs).

    stmt = "UPDATE users SET last_login = $1 WHERE id = $2"

    _, err = services.DB.ExecContext(ctx, stmt, time.Now(), id)
[ Parent | on HN ]
Re:Security assessment techniques for Go projects by pstuart on Friday November 08, 2019 @11:54AM (#21484085)
That is the correct approach.
[ Parent | on HN ]
Re:Security assessment techniques for Go projects by rhinoceraptor on Friday November 08, 2019 @12:39PM (#21484645)
That would only be vulnerable if the DB client is replacing your parameterized query with string concatenation under the hood.
[ Parent | on HN ]